From 7054cd10b17f602a0d6958e618ab327c5fdce3da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Gardou?= <jerome.gardou@reactos.org>
Date: Tue, 23 Mar 2021 18:15:23 +0100
Subject: [PATCH] [CSRSRV] Fix locking logic when destroying threads &
 processes

---
 subsystems/win32/csrsrv/procsup.c  | 3 ++-
 subsystems/win32/csrsrv/thredsup.c | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/subsystems/win32/csrsrv/procsup.c b/subsystems/win32/csrsrv/procsup.c
index de9743cd6c2..c580328b1e8 100644
--- a/subsystems/win32/csrsrv/procsup.c
+++ b/subsystems/win32/csrsrv/procsup.c
@@ -167,8 +167,9 @@ CsrLockedDereferenceProcess(PCSR_PROCESS CsrProcess)
     {
         /* Call the generic cleanup code */
         DPRINT1("Should kill process: %p\n", CsrProcess);
-        CsrAcquireProcessLock();
         CsrProcessRefcountZero(CsrProcess);
+        /* Acquire again, the lock it was released in CsrProcessRefcountZero */
+        CsrAcquireProcessLock();
     }
 }
 
diff --git a/subsystems/win32/csrsrv/thredsup.c b/subsystems/win32/csrsrv/thredsup.c
index 678a468812c..9f674b4942f 100644
--- a/subsystems/win32/csrsrv/thredsup.c
+++ b/subsystems/win32/csrsrv/thredsup.c
@@ -474,8 +474,9 @@ CsrLockedDereferenceThread(IN PCSR_THREAD CsrThread)
     if (LockCount == 0)
     {
         /* Call the generic cleanup code */
-        CsrAcquireProcessLock();
         CsrThreadRefcountZero(CsrThread);
+        /* Acquire the lock again, it was released by CsrThreadRefcountZero */
+        CsrAcquireProcessLock();
     }
 }